ACI objects, access relationships, and policy
Model ACI as related objects and actual endpoints
ACI separates organizational policy, forwarding context, endpoint classification, and physical attachment. A tenant is not itself a completed application network. A VRF defines a routing context; bridge domains define Layer 2 scope and relevant routing behavior; EPGs express endpoint policy grouping. Sharing a bridge domain does not require identical EPG permissions, and separate VRFs can intentionally carry overlapping addresses when their isolation is preserved.
APIC manages policy and fabric lifecycle; it is not an inline hop for every user packet. Distinguish controller management health from already programmed forwarding behavior. Existing traffic can continue through some controller failures without proving that new policy operations, visibility, or every fabric function remain healthy.
Trace the complete attachment chain
For a static attachment, identify the actual endpoint port and encapsulation, then trace interface selection, policy group, AEP, domain, VLAN pool, and EPG relationships. Link-up alone does not prove the policy has been deployed correctly. A binding that requests a VLAN outside its applicable domain pool or a server transmitting a different tag can prevent the intended classification even when the objects look complete in isolation.
Virtual integration adds another attachment layer. An EPG association does not automatically place every VM NIC on the intended port group. Compare actual virtual-network attachment, physical path, observed endpoint location, and policy mapping. An endpoint move needs coherent learning and location state, not only a renamed inventory entry.
Validate forwarding and permission separately
Within the stated enforced policy context, inter-EPG routes do not automatically authorize application traffic. Check provider and consumer relationships, filter protocol and port, contract scope, and any relevant exceptions. Ordinary same-EPG behavior differs from inter-EPG enforcement; explicitly consider intra-EPG isolation, intra-EPG contracts, or other configured restrictions when those requirements apply.
Bridge-domain addressing, routing enablement, ARP handling, and endpoint-resolution choices must match the design. Do not infer a valid default gateway from a subnet object while ignoring host masks or routing settings. Likewise, do not widen permissions merely because an unexplained test failed: endpoint classification, access deployment, and routing can fail independently.
Correlate faults, events, health summaries, audit records, and traffic evidence. A high aggregate score does not erase a localized interface fault. Audit records help explain configuration actions and actors, while faults describe detected conditions. Keep changes targeted to the identified relationship, preserve dependencies, and verify the application path after the change.